Details
-
Bug
-
Status: Closed
-
High
-
Resolution: Fixed
-
None
-
None
-
None
-
Platform Sprint 132
Description
When iterating through the nodes in a query result via
javax.jcr.query.QueryResult queryResult = ...; for (Node node : new NodeIterable(queryResult.getNodes())) { System.out.println(node.getPath()); }
It will always work since in case a node in the search result is unauthorized (should normally not happen), it still gets skipped by org.apache.jackrabbit.core.query.lucene.NodeIteratorImpl (and only a warning is logged). Since search results are non-transactional, this (an unauthorized node during iteration being skipped) can always happen even without the authorization query.
If however, instead of queryResult.getNodes(), you use
javax.jcr.query.QueryResult queryResult = ...; while (rows.hasNext()) { final Row row = rows.nextRow(); final Value[] values = row.getValues(); }
the code above throws a repository exception on 'row.getValues()' if the backing jcr node cannot be read (unauthorized).
We should in jackrabbit RowIteratorImpl first fetch the node and log a warning if it is not allowed to be read.
Attachments
Issue Links
- includes
-
CMS-10191 Deploy new JR 2.10 -h12 jackrabbit dependencies and update project pom
- Closed
- is cloned by
-
REPO-1512 [Backport 7.9] Make query results more resilient to not break on unauthorized results but skip them
- Closed
- relates to
-
REPO-1497 Parent and/or child axis queries can break under certain conditions
- Closed